Using input lookup

[MK3]

Hello,

If I want to use a external file that contains 2 columns C and D and use those mappings to a existing query that displays a table with the value C (so it is like a case statement that gives a D value for each value of C by checking a external csv file); what is wrong in this syntax -

index="...*" "... events{}.name=ResourceCreated | bin _time span=1h | spath "events{}.tags.A" | dedup "events{}.tags.A" |
inputcsv append=t Map.csv | stats D
as D by C | table "events{}.tags.A" "events{}.tags.B" "events{}.tags.C" "events{}.tags.D" _time | collect index=_xyz_summary marker="search_name=\"test_new_query_4cols\""

I get error -

Error in 'stats' command: The number of wildcards between field specifier '*' and rename specifier 'D' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*).

I tried switch case but showing default value always.

Thanks

[gcusello · Accepted solution]

Hi @MK3 ,

as also @ITWhisperer said, this isn't a valid SPL search, in addition, you should save your csv in a lookup and use the lookup command.

In addition, you cannot put a field in a stats command without a function and you don't need the stats command.

so try something like this:

index="...*" "... events{}.name=ResourceCreated 
| bin _time span=1h 
| spath "events{}.tags.A" 
| rename "events{}.tags.A" AS "A" "events{}.tags.C" AS "C"
| lookup Map.csv C OUTPUT D
| table A B C D _time 
| collect index=_xyz_summary marker="search_name=test_new_query_4cols"

Ciao.

Giuseppe

[gcusello]

Hi @MK3 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[ITWhisperer]

Given that the statement you shared is not valid SPL, perhaps it would be more useful if you shared what you are actually doing (anonymised only where necessary) so we might be able to determine what might be wrong